Introduces a higher-order topology that wraps two OPNSenseFirewall
instances (primary + backup) and orchestrates score application across
both. CARP VIPs get differentiated advskew values (primary=0,
backup=configurable) while all other scores apply identically to both
firewalls.
Includes CarpVipScore, DhcpServer delegation, pair Score impls for all
existing OPNsense scores, and opnsense_from_config() factory method.
Also adds ROADMAP entries for generic firewall trait (10), delegation
macro, integration tests, and named config instances (11).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Jean-Gabriel Gill-Couture
cb2a650d8b